Not applying XML escape

[cognition9144]

Prerequisites

• I have searched the Issues list for open and closed issues and believe this is a unique, currently unreported bug.

Describe the bug

A clear and concise description of what the bug is.
When exporting/importing the playlist, Vocal doesn't escape special symbols for XML files. Due to that problem, when importing, the interface will be blank (although from stdout there will be some output for all podcasts).
Then if restart vocal, other podcasts are fine, whereas the one with a problematic URL shows a exclaimer cover. Click it, vocal wil crash.

To Reproduce

Steps to reproduce the behavior:

1. Add an url with & or other symbols.
2. Export the playlist.
3. Import the playlist.
4. Restart Vocal.
5. Click on the cover with a problematic URL.

Expected behavior

' is replaced with '
" is replaced with "
& is replaced with &
< is replaced with &lt;
> is replaced with &gt;

Screenshots or screen recordings

Logs

**** parser error : EntityRef: expecting ';'
/****/5bc8e707-4ea8-4969-b6c3-ab6400a58a21&type
                                                                               ^
[INFO 22:46:22.844786] Library.vala:203: Error parsing OPML file.

Platform Information

Please share as many of the following details as possible:

• Linux distrubution: Manjaro
• OS version: 19.0.2
• Desktop environment: GNOME

Please check the applicable option below:

• I'm using the latest version from git that I've manually compiled
• I'm using the latest version of the Flatpak, downloaded from Flathub.org
• I'm using the latest version available from AppCenter
• I'm using a different version (please note here) : From Arch's official repo.

Additional context

[Hanouta]

I think it would be enough to only escape the & symbol. Or are there any Podcasts that use characters like "<>' in the Feed URL? 🤣 Even the & symbol seems to be very rare(I couldn't even find one).

[cognition9144]

I think it would be enough to only escape the & symbol. Or are there any Podcasts that use characters like "<>' in the Feed URL? rofl Even the & symbol seems to be very rare(I couldn't even find one).

Well I think & is quite common in URLs (for GET query). Other than that, it seems other symbols are likely to appear in the title of podcasts (which will be outline in XML).

[cognition9144]

I find that it may not be a good idea to do substitution. A better way is to use the CDATA. e.g.

<title><![CDATA[ YOUR RAW CONTENT]]></title>

It makes the content more readable and requires no postpreocessing outside the XML world. Also, it's valid for CJK languages.

[Hanouta]

I just pushed a fix for this to one of my branches, will probably create a Pull request in a few days.

[cognition9144]

I just pushed a fix for this to one of my branches, will probably create a Pull request in a few days.

Thats fantastic. It works. However on your branch, any import will cause crashing right after Vocal said:

[INFO 16:21:41.626143] Controller.vala:535: Adding feed https://***&type=mp4
[INFO 16:21:41.626418] Library.vala:375: Adding podcast from file: https://****&type=mp4
[INFO 16:21:41.959566] Library.vala:387: Async Adding ****
[INFO 16:21:41.959659] Library.vala:253: Podcast **** being added to library.
[1]    1269682 segmentation fault (core dumped)  com.github.needleandthread.vocal

Core dump:

                Stack trace of thread 1269682:
                #0  0x00007f990b781abf __poll (libc.so.6 + 0xf4abf)
                #1  0x00007f990cd197a0 n/a (libglib-2.0.so.0 + 0x6d7a0)
                #2  0x00007f990cd1a843 g_main_loop_run (libglib-2.0.so.0 + 0x6e843)
                #3  0x0000562f697ca400 vocal_controller_add_podcast_feed (com.github.needleandthread.vocal + 0x1b400)
                #4  0x0000562f697d012d vocal_main_window_on_add_podcast_feed (com.github.needleandthread.vocal + 0x2112d)
                #5  0x00007f990b89b61a g_closure_invoke (libgobject-2.0.so.0 + 0x3e61a)
                #6  0x00007f990b87c97e n/a (libgobject-2.0.so.0 + 0x1f97e)
                #7  0x00007f990b87fab9 g_signal_emit_valist (libgobject-2.0.so.0 + 0x22ab9)
                #8  0x00007f990b8816b0 g_signal_emit (libgobject-2.0.so.0 + 0x246b0)
                #9  0x00007f990b8800a0 g_signal_emit_valist (libgobject-2.0.so.0 + 0x230a0)
                #10 0x00007f990b8816b0 g_signal_emit (libgobject-2.0.so.0 + 0x246b0)
                #11 0x00007f990c221a4f n/a (libgtk-3.so.0 + 0x399a4f)
                #12 0x00007f990c221b25 n/a (libgtk-3.so.0 + 0x399b25)
                #13 0x00007f990b89b61a g_closure_invoke (libgobject-2.0.so.0 + 0x3e61a)
                #14 0x00007f990b87cad4 n/a (libgobject-2.0.so.0 + 0x1fad4)
                #15 0x00007f990b87fab9 g_signal_emit_valist (libgobject-2.0.so.0 + 0x22ab9)
                #16 0x00007f990b8816b0 g_signal_emit (libgobject-2.0.so.0 + 0x246b0)
                #17 0x00007f990c220031 n/a (libgtk-3.so.0 + 0x398031)
                #18 0x00007f990c259e1d n/a (libgtk-3.so.0 + 0x3d1e1d)
                #19 0x00007f990b8800a0 g_signal_emit_valist (libgobject-2.0.so.0 + 0x230a0)
                #20 0x00007f990b8816b0 g_signal_emit (libgobject-2.0.so.0 + 0x246b0)
                #21 0x00007f990c15e0ad n/a (libgtk-3.so.0 + 0x2d60ad)
                #22 0x00007f990b898903 g_cclosure_marshal_VOID__BOXEDv (libgobject-2.0.so.0 + 0x3b903)
                #23 0x00007f990b8800a0 g_signal_emit_valist (libgobject-2.0.so.0 + 0x230a0)
                #24 0x00007f990b8816b0 g_signal_emit (libgobject-2.0.so.0 + 0x246b0)
                #25 0x00007f990c15a3f3 n/a (libgtk-3.so.0 + 0x2d23f3)
                #26 0x00007f990c15e8e3 n/a (libgtk-3.so.0 + 0x2d68e3)
                #27 0x00007f990c15ca53 n/a (libgtk-3.so.0 + 0x2d4a53)
                #28 0x00007f990c18eb23 gtk_event_controller_handle_event (libgtk-3.so.0 + 0x306b23)
                #29 0x00007f990bfc897f n/a (libgtk-3.so.0 + 0x14097f)
                #30 0x00007f990c25f4ec n/a (libgtk-3.so.0 + 0x3d74ec)
                #31 0x00007f990b8800a0 g_signal_emit_valist (libgobject-2.0.so.0 + 0x230a0)
                #32 0x00007f990b8816b0 g_signal_emit (libgobject-2.0.so.0 + 0x246b0)
                #33 0x00007f990bfc8ad6 n/a (libgtk-3.so.0 + 0x140ad6)
                #34 0x00007f990c10edd5 n/a (libgtk-3.so.0 + 0x286dd5)
                #35 0x00007f990c11236c gtk_main_do_event (libgtk-3.so.0 + 0x28a36c)
                #36 0x00007f990be20ed4 n/a (libgdk-3.so.0 + 0x94ed4)
                #37 0x00007f990bdcdc24 n/a (libgdk-3.so.0 + 0x41c24)
                #38 0x00007f990cd179be g_main_context_dispatch (libglib-2.0.so.0 + 0x6b9be)
                #39 0x00007f990cd19831 n/a (libglib-2.0.so.0 + 0x6d831)
                #40 0x00007f990cd19871 g_main_context_iteration (libglib-2.0.so.0 + 0x6d871)
                #41 0x00007f990b9592ce g_application_run (libgio-2.0.so.0 + 0x9d2ce)
                #42 0x0000562f697c882b vocal_vocal_app_main (com.github.needleandthread.vocal + 0x1982b)
                #43 0x0000562f697c80a2 main (com.github.needleandthread.vocal + 0x190a2)
                #44 0x00007f990b6b4023 __libc_start_main (libc.so.6 + 0x27023)
                #45 0x0000562f697c80ee _start (com.github.needleandthread.vocal + 0x190ee)

[Hanouta]

That happens on the master branch of the Project as well(when it tries to update the feeds). Should be fixed by this commit, which is on a different branch because I had already opened the PR right after fixing that(didn't really plan to do that many commits/bug fixes back then). Maybe I should just close PR #437 and #439 and apply the commits to the other branch and then do a PR with all the fixes.